memhouse 0.13.0 → 0.15.0

package/bin/memhouse.js

@@ -28,6 +28,8 @@ const {
   SCHEMA_VERSION, MIN_WRITER_SCHEMA, MIGRATIONS, META_TYPES, createStatement,
 } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
+const { consumeSecretChunk } = require(path.join(REPO_ROOT, 'memhouse', 'secret-input'));
+const { capabilitiesFrom } = require(path.join(REPO_ROOT, 'memhouse', 'capabilities'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
 const ENV_FILE = path.join(HOME_DIR, 'env');
@@ -161,6 +163,24 @@ async function ch(cfg, sql, { database = cfg.db, settings = null, timeout = 3000
   if (!res.ok) throw new Error(text.trim().split('\n')[0]);
   return text.trim();
 }
+/**
+ * The grant lines ClickHouse reports for a user, as strings.
+ *
+ * Never pass a FORMAT here — chRows appends its own, and a statement carrying two is a
+ * syntax error. That mistake once read as "no grants at all", which refused every
+ * credential including a genuine superuser, and it was invisible on any machine whose
+ * own credential is an ordinary member.
+ *
+ * Unreadable grants come back as [] rather than throwing: a credential that cannot read
+ * its own grants is, for every decision made from this, simply not an administrator.
+ */
+async function readGrants(cfg, user) {
+  try {
+    const rows = await chRows(cfg, `SHOW GRANTS FOR ${user}`, { database: '' });
+    return rows.map((r) => Object.values(r).join(' '));
+  } catch { return []; }
+}
+
 async function chRows(cfg, sql, opts) {
   const text = await ch(cfg, sql + ' FORMAT JSONEachRow', opts);
   return text ? text.split('\n').map((l) => JSON.parse(l)) : [];
@@ -270,16 +290,20 @@ function askSecret(label, dflt = '') {
     const wasRaw = stdin.isRaw;
     stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf-8');
     let buf = '';
-    const onData = (ch) => {
-      if (ch === '\r' || ch === '\n' || ch === '\u0004') {
-        stdin.removeListener('data', onData);
-        stdin.setRawMode(!!wasRaw); stdin.pause();
-        process.stdout.write('\n');
-        return resolve(buf || dflt);
-      }
-      if (ch === '\u0003') { process.stdout.write('\n'); process.exit(130); }
-      if (ch === '\u007f' || ch === '\b') { buf = buf.slice(0, -1); return; }
-      buf += ch;
+    // One 'data' event carries a CHUNK, not a keystroke — see memhouse/secret-input.js
+    // for why that distinction is load-bearing and what it broke.
+    let done = false;
+    const onData = (chunk) => {
+      if (done) return;
+      const r = consumeSecretChunk(buf, chunk);
+      buf = r.buf;
+      if (r.interrupted) { process.stdout.write('\n'); process.exit(130); }
+      if (!r.done) return;
+      done = true;
+      stdin.removeListener('data', onData);
+      stdin.setRawMode(!!wasRaw); stdin.pause();
+      process.stdout.write('\n');
+      resolve(buf || dflt);
     };
     stdin.on('data', onData);
   });
@@ -325,9 +349,11 @@ Setup        onboard              interactive wizard: discover → configure →
                                   --env FILE installs from an invite file (see: invite)
              invite <name>        mint a member + house on the server and write the env
                                   file their install needs (--url --admin-user
-                                  --admin-password [--db NAME] [--out FILE]); local
-                                  machine untouched. Refuses a house that already holds
-                                  someone's messages — --adopt if sharing it is intended
+                                  [--admin-password, else prompted] [--db NAME]
+                                  [--out FILE]); local machine untouched. Refuses a house
+                                  that already holds someone's messages — --adopt if
+                                  sharing it is intended. Not an admin? --print-sql gives
+                                  the statements to hand to whoever is
              passwd               rotate this member's password + rewrite the env file
                                   (admin-assisted: --admin-user --admin-password)
                                   --print-sql            print the SQL, run it yourself
@@ -356,6 +382,8 @@ Data         ship                 one incremental pass (--full | --loop [sec])
              resume <session-id>  print the command that reopens that session in its editor
              sessions-query       print the session rollup SQL for this credential
              start | stop |       shipper loop + dashboard as background daemons
+             whoami               which credential is in play, and what it may do
+                                  (--json; --admin reads MEMHOUSE_ADMIN_*)
              status               daemons, connection, counts, freshness (--json)
              doctor               diagnose the whole pipeline
 
@@ -2911,9 +2939,77 @@ async function cmdNightly() {
  * transfer, and rotation (memhouse passwd) is printed because the inviter knows this
  * password until the invitee changes it.
  */
+/**
+ * `memhouse whoami [--json] [--admin]`
+ *
+ * Which credential is in play here, and what may it actually do. Exists so nothing has
+ * to hand-roll `SHOW GRANTS` and grep the result — a skill that reasons about privileges
+ * in prose gets it subtly wrong, and the wrong answer is either "you cannot" to an
+ * administrator or "go ahead" to a member who is about to hit ACCESS_DENIED.
+ *
+ * `--admin` resolves MEMHOUSE_ADMIN_USER / MEMHOUSE_ADMIN_PASSWORD first, so an agent
+ * can ask "is there an admin credential in this environment?" without inventing a place
+ * to store one. Nothing here prints or persists a password.
+ */
+async function cmdWhoami() {
+  const cfg = resolveConfig();
+  const wantAdmin = flags.admin === true;
+  const au = process.env.MEMHOUSE_ADMIN_USER;
+  const ap = process.env.MEMHOUSE_ADMIN_PASSWORD;
+  const usingAdminEnv = wantAdmin && au;
+  const who = usingAdminEnv ? { ...cfg, user: au, password: ap || '' } : cfg;
+
+  if (!who.url || !who.user) {
+    const msg = 'no credential configured';
+    if (JSON_OUT) console.log(JSON.stringify({ ok: false, reason: msg }, null, 2));
+    else {
+      console.log(bad(`${msg} — nothing in ${short(ENV_FILE)} and no MEMHOUSE_URL/MEMHOUSE_USER set.`));
+      if (wantAdmin) console.log('  For --admin, export MEMHOUSE_ADMIN_USER and MEMHOUSE_ADMIN_PASSWORD.');
+    }
+    return 1;
+  }
+
+  let server = null;
+  try { server = (await chRows(who, 'SELECT currentUser() AS u', { database: '' }))[0]?.u; }
+  catch (e) {
+    const reason = netReason(e);
+    if (JSON_OUT) console.log(JSON.stringify({ ok: false, url: who.url, user: who.user, reason }, null, 2));
+    else console.log(bad(`cannot reach ${who.url} as '${who.user}': ${reason}`));
+    return 1;
+  }
+
+  const grants = await readGrants(who, server);
+  const caps = capabilitiesFrom(grants);
+  const source = usingAdminEnv ? 'MEMHOUSE_ADMIN_* environment'
+    : (process.env.MEMHOUSE_USER ? 'MEMHOUSE_* environment' : short(ENV_FILE));
+  const role = caps.isSuperuser ? 'administrator'
+    : caps.canProvision ? 'can provision (users and houses)'
+      : 'member';
+
+  if (JSON_OUT) {
+    console.log(JSON.stringify({
+      ok: true, url: who.url, user: server, db: who.db, source, role, ...caps,
+      grants_readable: grants.length > 0,
+    }, null, 2));
+    return 0;
+  }
+  console.log(ok(`${server} at ${who.url} — ${role}`));
+  console.log(`  credential from: ${source}`);
+  console.log(`  house:           ${who.db || '(none set)'}`);
+  console.log(`  may create users:    ${caps.canMintUsers ? 'yes' : 'no'}`);
+  console.log(`  may create houses:   ${caps.canMintHouses ? 'yes' : 'no'}`);
+  console.log(`  may read any house:  ${caps.canReadEveryHouse ? 'yes' : 'no'}`);
+  if (!grants.length) console.log(warn('could not read its own grants — treating it as a member'));
+  if (!caps.canProvision) {
+    console.log('  Inviting and server-wide administration need an administrator; this is not one.');
+    console.log('  Supply one for this shell:  export MEMHOUSE_ADMIN_USER=… MEMHOUSE_ADMIN_PASSWORD=…');
+  }
+  return 0;
+}
+
 async function cmdInvite() {
   const name = positional[0];
-  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> --admin-user … --admin-password … [--db <house>] [--out <file>] [--adopt]'); return 2; }
+  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> [--admin-user … [--admin-password …]] [--db <house>] [--out <file>] [--adopt] [--print-sql]'); return 2; }
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(name, 'member'); }
   catch (e) { console.log(bad(e.message)); return 1; }
   const cfg = resolveConfig();
@@ -2936,27 +3032,97 @@ async function cmdInvite() {
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(db, 'house'); }
   catch (e) { console.log(bad(e.message)); return 1; }
 
+  // The way out for someone who is NOT the administrator. Being unable to invite is not a
+  // bug to be worked around — a member holds no CREATE USER by design — but "ask your
+  // admin" is only useful if you can hand them something exact. This prints the same
+  // statements adminBootstrap would run, so the person with the credential runs four
+  // lines instead of installing anything. Nothing is contacted and nothing is written.
+  if (flags['print-sql'] === true) {
+    const password = flags['member-password'] && flags['member-password'] !== true
+      ? String(flags['member-password']) : generatePassword();
+    console.log(`-- memhouse: give '${name}' an account and their own house on this ClickHouse.`);
+    console.log(`-- Run as a user with ACCESS MANAGEMENT (a stock 'default' will do).`);
+    console.log(memberSql(db, name, password));
+    console.log('-- Then send them these four lines — they are a credential, so use a channel');
+    console.log('-- you trust (croc, a password manager), not chat:');
+    console.log(`--   MEMHOUSE_URL='${url}'`);
+    console.log(`--   MEMHOUSE_USER='${name}'`);
+    console.log(`--   MEMHOUSE_PASSWORD='${password}'`);
+    console.log(`--   MEMHOUSE_DB='${db}'`);
+    console.log(`-- They install with:  memhouse install --url ${url} --user ${name} --password '…' --db ${db}`);
+    return 0;
+  }
+
   // Whose credential mints the member. Explicit --admin-* wins; otherwise TRY THE
-  // CONFIGURED ONE — an install made as an admin-capable ClickHouse user (access
-  // management) can invite with no extra flags, which is the common case for the person
-  // who set the house up. Fall back to asking only when the stored credential cannot
-  // read system.users (the proxy for "can it provision").
+  // CONFIGURED ONE — a `deploy --local` house makes its member the superuser
+  // (CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1), so the person who stood the house up
+  // invites with no extra flags.
   let adminUser = flags['admin-user'];
   let adminPass = flags['admin-password'];
   if (!adminUser) {
     const c = requireConfig(cfg, 'invite');
     if (!c.user) return 1;
+    // Ask what this credential may actually DO, not whether it can look at a table.
+    // The old probe was `SELECT 1 FROM system.users` — but since 0.12.6 every member is
+    // granted SHOW USERS, so every member passed it, was told "it can manage users on
+    // this house", and then died at CREATE DATABASE with a raw ACCESS_DENIED. A probe
+    // that says yes to everyone is worse than no probe: it turns "you are not an admin"
+    // into a confusing failure three steps later.
+    //
+    // chRows appends FORMAT itself, so DO NOT pass one — a statement carrying FORMAT
+    // twice is a syntax error, which the catch below turned into "no grants" and refused
+    // EVERY credential, a real superuser included. Only a clean machine could show that:
+    // this machine's credential is a member either way, so the bug was invisible here.
+    // Reachability FIRST, and reported as itself. Folding it into the grants read makes an
+    // unreachable host — a typo, a loopback-bound house, a tunnel that is down — come back
+    // as "you are only a member", which sends the reader after a privilege they already
+    // have. Caught on the testbed, where a wrong --url produced exactly that.
     try {
-      await ch({ ...c, url }, 'SELECT 1 FROM system.users LIMIT 1', { database: '' });
+      await ch({ ...c, url }, 'SELECT 1', { database: '' });
+    } catch (e) {
+      console.log(bad(`cannot reach ${url} as '${c.user}': ${netReason(e)}`));
+      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
+      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
+      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
+      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      return 1;
+    }
+    // What this credential may do, judged from its own grants and SCOPE-AWARE — a member
+    // holds CREATE DATABASE inside `ON <their-db>.*`, which mints no new house at all.
+    // Shared with `whoami` so the two can never disagree about who is an administrator.
+    const caps = capabilitiesFrom(await readGrants({ ...c, url }, c.user));
+    if (caps.canProvision) {
       adminUser = c.user; adminPass = c.password;
-      console.log(ok(`inviting as your own credential '${c.user}' (it can manage users on this house)`));
-    } catch {
-      console.log(bad('your configured credential cannot create users on this house.'));
-      console.log('  Pass an admin that can:  --admin-user <a> --admin-password <p>');
+      console.log(ok(`inviting as your own credential '${c.user}' (it can create users and houses here)`));
+    } else {
+      console.log(bad(`'${c.user}' is a MEMBER of this ClickHouse, not an administrator — it cannot create accounts.`));
+      console.log('  Inviting mints a ClickHouse user and a database, which needs CREATE USER and');
+      console.log('  CREATE DATABASE. A member deliberately holds neither: that is the boundary that');
+      console.log('  keeps one housemate out of another house.');
+      console.log('');
+      console.log('  If you RUN this ClickHouse — use the admin credential you created it with');
+      console.log('  (for a stock server that is `default`); memhouse never stores it, so pass it');
+      console.log('  per invite and it is used for one connection and discarded:');
+      console.log(`     memhouse invite ${name} --url ${url} --admin-user default`);
+      console.log('     (leave --admin-password off and it is prompted for, so it stays out of');
+      console.log('      your shell history and the process list)');
+      console.log('');
+      console.log('  If SOMEONE ELSE runs it — you cannot invite, and no flag changes that.');
+      console.log('  Print the statements and send them to whoever administers the server:');
+      console.log(`     memhouse invite ${name} --url ${url} --print-sql`);
       return 1;
     }
   } else if (adminPass === undefined) {
-    console.log(bad('--admin-user given without --admin-password')); return 1;
+    // Prompt rather than refuse. A password given as --admin-password lands in the
+    // process list for the life of the request and in shell history unless the caller
+    // remembered a leading space; asking for it keeps it in this process only.
+    // Non-TTY (an agent, CI) still gets the old refusal — there is nobody to ask.
+    if (!process.stdin.isTTY) {
+      console.log(bad('--admin-user given without --admin-password (no TTY to prompt on)'));
+      return 1;
+    }
+    adminPass = await askSecret(`  password for '${adminUser}'`);
+    if (!adminPass) { console.log(bad('no password given')); return 1; }
   }
 
   // WHERE to connect to provision. --url is the address the INVITEE will use — it may be
@@ -3358,6 +3524,7 @@ async function cmdUninstall() {
       }
       break;
     case 'reset': process.exitCode = await cmdReset(); break;
+    case 'whoami': process.exitCode = await cmdWhoami(); break;
     case 'invite': process.exitCode = await cmdInvite(); break;
     case 'passwd': process.exitCode = await cmdPasswd(); break;
     case 'nightly': process.exitCode = await cmdNightly(); break;

package/memhouse/capabilities.js

@@ -0,0 +1,75 @@
+// What a ClickHouse credential may actually DO, read from its own grants.
+//
+// This exists because asking the wrong question here is expensive and quiet. `invite`
+// used to probe with `SELECT 1 FROM system.users`: since 0.12.6 every member holds
+// SHOW USERS, so every member passed, was told it could manage users, and then died at
+// CREATE DATABASE with a raw ACCESS_DENIED. The replacement must be exact, and it must
+// live in one place — invite and /mem:admin disagreeing about who is an administrator is
+// the same class of bug wearing a different hat.
+//
+// SCOPE IS THE WHOLE POINT. A grant is `GRANT <privileges> ON <scope> TO <user>`, and a
+// privilege only means what its scope allows: an ordinary member holds CREATE DATABASE
+// inside `ON polat.*`, which lets them do nothing whatsoever about creating a NEW
+// database. Matching the privilege name anywhere in the text — which an earlier draft of
+// this did — reads that member as a server administrator. So parse the line, keep the
+// scope, and only count a privilege that is granted server-wide.
+
+/** `GRANT a, b, c ON scope TO user [WITH GRANT OPTION]` -> {privs:[…], scope} | null */
+function parseGrantLine(line) {
+  const m = /^\s*GRANT\s+(.+?)\s+ON\s+(\S+)\s+TO\s+/i.exec(String(line || ''));
+  if (!m) return null;
+  const privs = m[1].split(',').map((p) => p.trim().toUpperCase()).filter(Boolean);
+  return { privs, scope: m[2] };
+}
+
+/** Server-wide scope: `*.*` (tables everywhere) or `*` (the access/user namespace). */
+function isServerWide(scope) {
+  return scope === '*.*' || scope === '*';
+}
+
+function hasPriv(privs, name) {
+  return privs.includes(name);
+}
+
+/**
+ * Derive capabilities from the lines `SHOW GRANTS FOR <user>` returned.
+ *
+ * @param {string[]|string} grants  one string per grant line, or the whole blob
+ * @returns {{canMintUsers:boolean, canMintHouses:boolean, canProvision:boolean,
+ *            canReadEveryHouse:boolean, canSeeUsers:boolean, isSuperuser:boolean}}
+ */
+function capabilitiesFrom(grants) {
+  const lines = Array.isArray(grants) ? grants : String(grants || '').split('\n');
+  let canMintUsers = false;
+  let canMintHouses = false;
+  let canReadEveryHouse = false;
+  let canSeeUsers = false;
+
+  for (const raw of lines) {
+    const g = parseGrantLine(raw);
+    if (!g) continue;
+    const wide = isServerWide(g.scope);
+    // SHOW USERS is the one every member has — never evidence of anything.
+    if (hasPriv(g.privs, 'SHOW USERS')) canSeeUsers = true;
+    if (!wide) continue;
+    // Minting accounts. ACCESS MANAGEMENT is the umbrella; CREATE USER the specific.
+    if (hasPriv(g.privs, 'ACCESS MANAGEMENT') || hasPriv(g.privs, 'CREATE USER')) canMintUsers = true;
+    // Minting houses. `CREATE DATABASE` is the specific; bare `CREATE` is the umbrella
+    // ClickHouse hands a superuser (what `deploy --local` grants), and `ALL` covers both.
+    if (hasPriv(g.privs, 'CREATE DATABASE') || hasPriv(g.privs, 'CREATE') || hasPriv(g.privs, 'ALL')) canMintHouses = true;
+    // Reading anyone's rooms — what separates an administrator's view from a member's.
+    if (hasPriv(g.privs, 'SELECT') || hasPriv(g.privs, 'ALL')) canReadEveryHouse = true;
+  }
+
+  const canProvision = canMintUsers && canMintHouses;
+  return {
+    canMintUsers,
+    canMintHouses,
+    canProvision,
+    canReadEveryHouse,
+    canSeeUsers,
+    isSuperuser: canProvision && canReadEveryHouse,
+  };
+}
+
+module.exports = { capabilitiesFrom, parseGrantLine, isServerWide };

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines, plus administration of the ClickHouse behind it. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, /mem:users, and /mem:admin.",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/skills/admin/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: admin
-description: Operate the memhouse ClickHouse as its administrator — list and inspect every user and house, provision or remove members, grant and revoke access, and read server-wide health (disk, parts, mutations, running queries). Use when the user asks to "do X as admin", "manage users", "drop a house", "see disk usage", "who is on this server", or when a member-scoped skill refused for want of privileges. Requires an admin credential; says so plainly when there is not one.
+description: Operate the memhouse ClickHouse as its administrator — list and inspect every user and house, provision or remove members, grant and revoke access, and read server-wide health (disk, parts, mutations, running queries). Use when the user asks to "do X as admin", "manage users", "drop a house", "see disk usage", "who is on this server", or when a member-scoped skill refused for want of privileges. Requires an administrator credential in the environment; says so plainly, and how to supply one, when there is not.
 user-invocable: true
 argument-hint: "<what you want done>"
 allowed-tools: Bash
@@ -12,61 +12,61 @@ A member owns one database. An **administrator** owns the ClickHouse: every hous
 account, every grant. This skill is the second one, and it is the only skill allowed to
 act outside the caller's own house.
 
-Everything here runs through the same rule as `/mem:invite`: **an admin password must
-never enter this conversation.** memhouse ships this transcript into the house you are
-administering, so a password pasted in chat is a password published to the archive.
-Resolve it from the environment or a file, never from a prompt, and never echo it.
+**An admin password must never enter this conversation.** memhouse ships this transcript
+into the house you are administering, so a password pasted here is a password published
+to the archive — and unlike a file you can delete, the archive is insert-only. Resolve
+the credential from the environment or refuse. Never ask for one in chat, never echo one,
+never write one to a file.
 
-## 1. Find an admin credential — never ask for one in chat
-
-Try these in order and stop at the first that works. **Never print any of these files or
-the variables in them** — no `cat`, no `env | grep`, no `set -x`.
-
-```bash
-MH_HOME="${MEMHOUSE_HOME:-$HOME/.memhouse}"
-# a) an explicit admin credential in the environment
-ADM_U=${MEMHOUSE_ADMIN_USER-}; ADM_P=${MEMHOUSE_ADMIN_PASSWORD-}
-# b) an admin env file kept beside the member config
-if [ -z "$ADM_U" ] && [ -f "$MH_HOME/admin.env" ]; then
-  set -a; . "$MH_HOME/admin.env"; set +a
-  ADM_U=${MEMHOUSE_ADMIN_USER:-${MEMHOUSE_USER-}}; ADM_P=${MEMHOUSE_ADMIN_PASSWORD:-${MEMHOUSE_PASSWORD-}}
-fi
-# c) the ordinary member credential — on a house the pilot stood up themselves
-#    (memhouse deploy --local) the member IS the superuser
-set -a; [ -f "$MH_HOME/env" ] && . "$MH_HOME/env"; set +a
-: "${ADM_U:=${MEMHOUSE_USER-}}"; : "${ADM_P:=${MEMHOUSE_PASSWORD-}}"
-```
-
-Then **prove** it is actually an admin rather than assuming — a member can often read
-`system.users` while holding nothing else:
+## 1. Ask the CLI what you are holding — do not work it out yourself
 
 ```bash
-curl -sS --fail-with-body --user "$ADM_U:$ADM_P" \
-  --data-binary "SHOW GRANTS FOR $ADM_U FORMAT TSV" "$MEMHOUSE_URL/"
+memhouse whoami --admin --json
 ```
 
-Admin means the grants carry `ACCESS MANAGEMENT`, or `CREATE USER`/`CREATE DATABASE` at
-`*.*` — not merely `SHOW USERS`, which every member has. If none of a/b/c qualifies,
-**stop and say so**:
-
-> This needs administrator access to the ClickHouse at `<url>`, and the credential
-> configured here is the member account `<user>` — it owns its own house and nothing
-> else. To use `/mem:admin`, put an admin credential in `~/.memhouse/admin.env`
-> (`MEMHOUSE_ADMIN_USER=` / `MEMHOUSE_ADMIN_PASSWORD=`, mode 600) or export
-> `MEMHOUSE_ADMIN_USER` / `MEMHOUSE_ADMIN_PASSWORD`, then ask again. Whoever operates
-> the server has it; on a house from `memhouse deploy --local` it is the account already
-> in `~/.memhouse/env`.
-
-Do not offer to carry on with reduced powers, do not suggest the user paste a password
-into the chat, and do not improvise around the refusal. Say which of a/b/c you tried.
-
-## 2. Run the request
-
-Use the resolved credential for every query. `--fail-with-body` so ClickHouse's own error
-is visible; add `&readonly=1` on anything that only reads.
+That resolves `MEMHOUSE_ADMIN_USER` / `MEMHOUSE_ADMIN_PASSWORD` when they are set and
+falls back to the configured credential, then reports what it may actually do. Read
+`role` and the capability flags; never infer privileges from a grant string yourself.
+The command prints no password.
+
+- **`"canProvision": true`** (or `"role": "administrator"`) — you have an administrator.
+  Go to §2.
+- **`"canProvision": false`** — the credential is a member. **Stop.** Do not retry, do
+  not look for a stored password, and do not ask for one. Tell the user:
+
+  > `/mem:admin` needs an administrator credential for `<url>`, and what is configured
+  > here is the member account `<user>` — it owns its own house and nothing else. If you
+  > administer that ClickHouse, put the credential in this shell's environment and ask
+  > again:
+  >
+  > ```
+  > export MEMHOUSE_ADMIN_USER=default
+  > read -rs MEMHOUSE_ADMIN_PASSWORD && export MEMHOUSE_ADMIN_PASSWORD
+  > ```
+  >
+  > `read -rs` keeps it off the screen and out of your shell history. It lives only in
+  > that shell — nothing is written to disk, and memhouse never stores it.
+  >
+  > If somebody else administers the server, this is theirs to run, not yours.
+
+- **`"ok": false`** — a connection problem, not a privilege one. Report `reason` as
+  given; do not translate it into "you are not an admin".
+
+**Never suggest storing the credential** — not in `~/.memhouse/env`, not in an
+`admin.env`, not anywhere on disk. An admin credential owns the whole server, and every
+process running as this user can read a file. The environment of one shell is the whole
+supported surface. (A house from `memhouse deploy --local` is the exception that needs
+nothing: its member *is* the superuser, and `whoami` will already say so.)
+
+## 2. Do the work
+
+Use the same environment for every query. `--fail-with-body` so ClickHouse's own error is
+visible; `&readonly=1` on anything that only reads.
 
 ```bash
-adm() { curl -sS --fail-with-body --user "$ADM_U:$ADM_P" --data-binary "$1" "$MEMHOUSE_URL/${2-}"; }
+adm() { curl -sS --fail-with-body \
+  --user "$MEMHOUSE_ADMIN_USER:$MEMHOUSE_ADMIN_PASSWORD" \
+  --data-binary "$1" "$MEMHOUSE_URL/${2-}"; }
 adm "SELECT …  FORMAT PrettyCompact" "?readonly=1"
 ```
 
@@ -74,21 +74,19 @@ Reads worth knowing — reach for these before inventing SQL:
 
 | Question | Query |
 |---|---|
-| who exists | `SELECT name FROM system.users ORDER BY name` |
-| what can someone do | `SHOW GRANTS FOR <user>` |
+| who exists | `SELECT name, storage FROM system.users ORDER BY name` |
+| what someone may do | `SHOW GRANTS FOR <user>` |
 | every house and its size | `SELECT database, formatReadableSize(sum(bytes_on_disk)) AS disk, sum(rows) AS rows FROM system.parts WHERE active GROUP BY database ORDER BY sum(bytes_on_disk) DESC` |
 | a house's rooms | `SELECT table, formatReadableSize(sum(bytes_on_disk)) AS disk, sum(rows) AS rows FROM system.parts WHERE active AND database = '<db>' GROUP BY table` |
 | who writes where | `SELECT user_id, host, count() FROM <db>.messages GROUP BY user_id, host` |
 | running queries | `SELECT query_id, user, elapsed, formatReadableSize(memory_usage) AS mem, substring(query,1,120) AS q FROM system.processes` |
 | unfinished mutations | `SELECT database, table, mutation_id, command, parts_to_do, latest_fail_reason FROM system.mutations WHERE NOT is_done` |
-| merge backlog | `SELECT database, table, elapsed, progress FROM system.merges` |
 
-Writes follow the shapes memhouse itself uses, so an admin-made member is identical to an
-invited one — a member gets `GRANT ALL ON <db>.* … WITH GRANT OPTION`, plus `SHOW USERS`,
-self-scoped `ALTER USER`, `REMOTE`, and the async-insert pin. **Prefer the CLI over raw
-SQL when one exists**: `memhouse invite <name> --url …` provisions a member correctly
-(and refuses a house that already holds someone's messages); this skill is for the things
-it does not cover.
+**Prefer a CLI verb over raw SQL wherever one exists.** `memhouse invite <name> --url …`
+provisions a member correctly — right grants, right pin, refuses a house that already
+holds someone's messages — and it takes `--admin-user`/`--admin-password`, so it works
+from this environment. Hand-written `CREATE USER` skips every one of those guards. This
+skill is for what no verb covers.
 
 ## 3. Destructive work — look first, then confirm
 
@@ -99,30 +97,33 @@ editors that produced them.
 
 Before any of them:
 
-1. **Look at the target and report what is actually there** — row counts per room, who
+1. **Look at the target and report what is really there** — row counts per room, who
    wrote them, the date span, which machines. A house you expected to be empty may not
-   be.
+   be: one `ege` house looked disposable and held 3,733 messages belonging to somebody
+   else entirely.
 2. **Name the collateral.** Dropping a user stops that account's shipper on every machine
-   it runs on. Revoking a grant closes a share the other person may be mid-query on.
-   Rotating a password breaks every machine shipping under it.
-3. **Get an explicit yes for that specific object**, quoting the counts you just read.
-   A general "yes do admin things" is not consent to drop a populated house.
-4. **Verify afterwards** and say what is now true.
+   it runs on. Revoking a grant closes a share someone may be mid-query on. Rotating a
+   password breaks every machine shipping under it — and grants are per-user while the
+   fleet is per-`user@host`, so there is no way to revoke one machine.
+3. **Get an explicit yes for that specific object**, quoting the counts you just read. A
+   general "yes, do admin things" is not consent to drop a populated house.
+4. **Verify afterwards** and say what is now true, including what was destroyed.
 
 If the user has already told you exactly what to destroy and why, and the counts match
-their description, proceed — do not re-litigate a decision they have made. Report the
-outcome plainly, including the row counts destroyed.
+their description, proceed — do not re-litigate a decision they have made.
 
 ## Never
 
 Never accept an admin password typed into the conversation, and never print one — not in
-a command, not in an echo, not in an error. If a command needs it, expand a shell
-variable (`--admin-password "$ADM_P"`), so the value never appears in the transcript.
+a command, not in an echo, not in an error. Commands expand `"$MEMHOUSE_ADMIN_PASSWORD"`;
+the value never appears as literal text.
+
+Never recommend writing an admin credential to disk.
 
-Never widen a member's grants beyond what `memhouse invite` issues without the user
-asking for that specific privilege and being told what it allows. Never grant
-`ACCESS MANAGEMENT`, `CREATE USER`, or anything at `*.*` casually — those make a second
+Never widen a member's grants beyond what `memhouse invite` issues unless the user asks
+for that specific privilege and has been told what it allows. Never grant `ACCESS
+MANAGEMENT`, `CREATE USER`, or anything at `*.*` casually — those mint a second
 administrator.
 
-Never touch a house that is not the subject of the request. Never run a destructive
+Never touch a house that is not the subject of the request, and never run a destructive
 statement whose predicate you have not first run as a `SELECT`.

package/memhouse/delivery/plugin/skills/invite/SKILL.md

@@ -42,14 +42,42 @@ substituted into a command — that burns the credential into the transcript on
    If it prints `invite written: …`, go to step 4 — you are done, and no admin secret
    ever touched this conversation.
 
-   ONLY if it fails with "your configured credential cannot create users" does
-   provisioning need a real admin. Do NOT take the admin password in chat — memhouse
-   archives this transcript. Hand the user the line to run THEMSELVES (a leading space
-   keeps it out of shell history):
-
-   ```
-   memhouse invite <name> --url <url> [--db <shared-house>] --admin-user <admin> --admin-password 'PASTE_IT_HERE'
-   ```
+   Otherwise read WHICH refusal came back; they need different answers.
+
+   **"cannot reach `<url>` …"** — nothing to do with privileges. The address is wrong,
+   or the house is bound to loopback (`memhouse deploy --local` binds to 127.0.0.1 on
+   purpose, so no LAN address reaches it and no invitee could either). Ask the user for
+   the address the invitee will actually use; do not retry with a guess.
+
+   **"`<user>` is a MEMBER of this ClickHouse, not an administrator"** — inviting needs
+   CREATE USER and CREATE DATABASE, which a member deliberately does not hold. Two cases,
+   and you must ask which one applies rather than assuming:
+
+   - **They run the ClickHouse.** They have the admin credential; memhouse never stores
+     it. Do NOT take that password in chat — memhouse archives this transcript. Hand them
+     the line to run THEMSELVES, and leave `--admin-password` OFF so it is prompted for,
+     keeping it out of both the process list and shell history:
+
+     ```
+     memhouse invite <name> --url <url> [--db <shared-house>] --admin-user <admin>
+     ```
+
+     **You cannot run that line yourself.** The prompt needs a TTY and your Bash tool has
+     none, so it refuses with "no TTY to prompt on" — and the fix is NOT to add
+     `--admin-password`, which would put the credential in this transcript. The user runs
+     it in their own terminal; you wait for them to say it is done.
+
+   - **Somebody else runs it.** They cannot invite, and no flag changes that. Print the
+     statements for whoever administers the server — this contacts nothing and needs no
+     credential:
+
+     ```
+     memhouse invite <name> --url <url> [--db <shared-house>] --print-sql
+     ```
+
+     The output ends with the four `MEMHOUSE_*` lines the invitee needs. Those lines are
+     a credential: tell the user to send them over a trusted channel, and **never print
+     them into the conversation yourself**.
 
    **If it refuses with "house `<db>` already exists and holds N messages", STOP.** That
    house is somebody's memory, and inviting into it would hand the invitee someone else's

package/memhouse/secret-input.js

@@ -0,0 +1,39 @@
+// Consuming a hidden-input chunk, as pure logic so it can be tested without a terminal.
+//
+// The subtlety this exists for: a raw-mode stdin 'data' event carries a CHUNK, not a
+// keystroke. While someone types, each chunk happens to be one character, so a handler
+// that compares the whole chunk against '\r' looks correct for as long as anyone tests it
+// by hand. The moment a password is PASTED — which is how a credential out of a password
+// manager actually arrives — the chunk is 'hunter2\r', equal to no terminator, and the
+// prompt hangs forever with the secret sitting in the buffer. Anything piping input hits
+// the same wall.
+//
+// So: walk the chunk. Callers own the terminal; this owns the decision.
+
+const ENTER = ['\r', '\n', '\u0004'];   // CR, LF, EOT
+const INTERRUPT = '\u0003';             // ctrl-C
+const ERASE = ['\u007f', '\b'];         // DEL, BS
+
+/**
+ * Fold one chunk into the accumulated buffer.
+ *
+ * @param {string} buf      what has been read so far
+ * @param {string} chunk    the raw 'data' payload (may hold any number of characters)
+ * @returns {{buf: string, done: boolean, interrupted: boolean}}
+ *   `done` — a terminator was seen; `buf` is the final value and anything after the
+ *   terminator in the same chunk is deliberately discarded (it belongs to whatever
+ *   prompt comes next, not this one).
+ *   `interrupted` — ctrl-C was seen; the caller decides how to exit.
+ */
+function consumeSecretChunk(buf, chunk) {
+  let out = String(buf == null ? '' : buf);
+  for (const ch of String(chunk == null ? '' : chunk)) {
+    if (ch === INTERRUPT) return { buf: out, done: false, interrupted: true };
+    if (ENTER.includes(ch)) return { buf: out, done: true, interrupted: false };
+    if (ERASE.includes(ch)) { out = out.slice(0, -1); continue; }
+    out += ch;
+  }
+  return { buf: out, done: false, interrupted: false };
+}
+
+module.exports = { consumeSecretChunk };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {